Published Gitea repository security advisories missing from the global Advisory Database

Bắt đầu bằng cách so sánh các advisory của repository đã được công bố cho GHSA-rcr6-4jqh-j84m và GHSA-6v53-hr58-556r với các tìm kiếm trong github/advisory-database và golang/vulndb. Kiểm tra cách các bản ghi Alpine hiện có xuất hiện trong cơ sở dữ liệu Grype, sau đó xác minh rằng cả hai Go advisory cho gitea.dev đều được thể hiện với bản sửa lỗi 1.27.1 và có thể được tìm thấy bằng các mã định danh GHSA và CVE của chúng.

Summary

Two published repository security advisories for Gitea are currently missing from the global GitHub Advisory Database:

GHSA	CVE	Package	Fixed in
GHSA-rcr6-4jqh-j84m	CVE-2026-60004	gitea.dev (Go)	1.27.1
GHSA-6v53-hr58-556r	CVE-2026-59774	gitea.dev (Go)	1.27.1

Both repository advisories are published and contain affected Go package/version information, but neither advisory appears to have been promoted to the global Advisory Database.

CVE-2026-60004 is particularly relevant because it has since been added to CISA's Known Exploited Vulnerabilities catalog.

Evidence

Searching github/advisory-database for either GHSA currently returns no matching advisory record:

GHSA-rcr6-4jqh-j84m -> no result
GHSA-6v53-hr58-556r -> no result

Neither CVE is currently present in golang/vulndb either:

CVE-2026-60004 -> no Go vulnerability record
CVE-2026-59774 -> no Go vulnerability record

This appears to have downstream consequences for vulnerability scanners.

For example, Syft/Grype correctly identifies an affected upstream Gitea binary as:

gitea.dev
v1.27.0-dev.0.20260629012003-8343c47bd112+dirty
go-module

This build predates both fixes and is in the affected version range.

However, Grype does not report either vulnerability for this Go module.

Inspecting the current Grype vulnerability database (v6.1.9, built 2026-08-27) shows why: the CVEs are present only through Alpine package metadata.

For CVE-2026-60004:

apk:forgejo < 15.0.6-r0
apk:gitea   < 1.27.1-r0

For CVE-2026-59774:

apk:gitea < 1.27.1-r0

There is no corresponding vulnerability record for:

Go / gitea.dev < 1.27.1

and searches for the two GHSA identifiers in the Grype database return no results.

As a result, upstream/self-built Gitea binaries can produce a false negative while distro-packaged Gitea installations are detected.

Expected result

Since the published repository advisories already identify the affected ecosystem as Go, package as gitea.dev, and patched version as 1.27.1, I would expect corresponding records to exist in the global GitHub Advisory Database.

This should subsequently allow consumers such as the Go Vulnerability Database and vulnerability scanners to associate the advisories with the gitea.dev Go module.

Related advisories

• GHSA-rcr6-4jqh-j84m / CVE-2026-60004
• GHSA-6v53-hr58-556r / CVE-2026-59774

This is not a new vulnerability disclosure; both vulnerabilities and all information above are already public.